High

Security advisory

Type: advisorySources: OSVCVE: CVE-2023-24580

An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.

Products: Not specified
Affected versions: Not specified
Fixed versions: Not specified
CVEs: CVE-2023-24580
Confirmed fixed CVEs: Not specified
Updated in this feed: 7 Nov 2026, 00:42 UTC · Revision 1

Source evidence

CVE-2023-24580

core-osv · Original source

Published 15 Feb 2023, 00:00 UTC

osv:CVE-2023-24580

Complete source record

{
  "id": "39931fcce0ed74b06aa8bf9ab8d6a0e5c1a6b0d9128370a30453453a4118ba98",
  "url": "https://osv.dev/vulnerability/CVE-2023-24580",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2023-24580",
    "summary": "An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.",
    "evidence": "osv:CVE-2023-24580",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2023-24580",
      "aliases": [
        "BIT-django-2023-24580",
        "CVE-2023-24580",
        "GHSA-2hrw-hx67-34x6",
        "PYSEC-2023-13"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/django/django",
              "type": "GIT",
              "events": [
                {
                  "introduced": "3591e1c1acbd7c13174275367c3fdf012cb0413b"
                },
                {
                  "fixed": "722e9f8a38f5b34f2423059a75f8a59bb8eb931a"
                },
                {
                  "introduced": "ef62a3a68c9d558486145a42c0d71ea9a76add9e"
                },
                {
                  "fixed": "4d51383f09870e3dade9967a60c956fb81b874a7"
                },
                {
                  "introduced": "9fee86e44dd83dc968ec443adcde191b3eba1286"
                },
                {
                  "fixed": "c57ff9ba5e251cd4c2761105a6046662c08f951e"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "3.2"
                      },
                      {
                        "fixed": "3.2.18"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "4.0"
                      },
                      {
                        "fixed": "4.0.10"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "4.1"
                      },
                      {
                        "fixed": "4.1.7"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-24580.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:48.338526785Z",
      "provider": "osv",
      "references": [
        "https://docs.djangoproject.com/en/4.1/releases/security/",
        "https://groups.google.com/forum/#%21forum/django-announce",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24580.json",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKYVMMR7RPM6AHJ2SBVM2LO6D3NGFY7B/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZS4G6NSZWPTVXMMZHJOJVQEPL3QTO77/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJB6FUBBLVKKG655UMTLQNN6UQ6EDLSP/",
        "https://nvd.nist.gov/vuln/detail/CVE-2023-24580",
        "https://security.netapp.com/advisory/ntap-20230316-0006/",
        "https://lists.debian.org/debian-lts-announce/2023/02/msg00023.html",
        "https://www.djangoproject.com/weblog/2023/feb/14/security-releases/"
      ],
      "provider_metadata": {
        "cna_assigner": "mitre",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24580.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2023-24580",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 516701,
  "published_at": "2023-02-15T00:00:00+00:00"
}